A system and method provide seamless control switchover through an input coupled to a power line and a safety apparatus that actuates if the input remains de-energized for a first time interval. Each of a plurality of subsystems has a control unit that controls a power source to energize the power line and is capable of transitioning between master and slave states. A first switch or second and third switches in series couple the power source to the power line. The first switch is closed during master state operation. The second switch is closed during slave operation and the third switch is open if any subsystem control unit is in master state. The system is configured to open or close the first switch, the second switch, or the third switch responsive to a transition of a control unit to or from master state within the first time interval.
|
1. A system for seamless switchover, the system comprising:
a first power line;
a safety device comprising:
a first input electrically coupled to the first power line; and
a safety apparatus, the safety device configured to actuate the safety apparatus in response to the first input being at a de-energized state for a first time interval; and
a plurality of subsystems, each subsystem comprising:
a control unit configured to be switchable between a master state and a slave state;
a first power source capable of energizing the first power line, the first power source configured to be controlled by the control unit;
a first switch electrically coupled to the first power source and to the first power line, the first switch configured to be closed while the control unit is in the master state;
a second switch electrically coupled to the first power source, the second switch configured to be closed while the control unit is in the slave state; and
a third switch electrically coupled to the second switch and to the first power line, the third switch configured to be open only while the control unit of any subsystem of the plurality of subsystems is in the master state,
the system configured to, within the first time interval, open or close the first switch, the second switch, or the third switch responsive to a transition of a control unit to or from the master state.
11. A system for seamless switchover, the system comprising:
a first power line;
a safety device comprising:
a first input electrically coupled to the first power line; and
a safety apparatus, the safety device configured to actuate the safety apparatus in response to the first input being at a de-energized state for a first time interval; and
a first subsystem and a second subsystem, each of the first and second subsystems comprising:
a control unit configured to be switchable between a master state and a slave state;
a first power source communicably coupled with the control unit and configured to energize the first power line, the first power source configured to be controlled by the control unit;
a first switch electrically coupled to the first power source and to the first power line, the first switch configured to be closed during a second time interval during which the control unit is in the master state;
a second switch electrically coupled to the first power source, the second switch configured to be closed during a third time interval during which the control unit is in the slave state; and
a third switch electrically coupled to the second switch and to the first power line, the third switch configured to be open only while the control unit of the first subsystem or the control unit of the second subsystem is in the master state; and
the system configured to, within the first time interval, open or close the first switch, the second switch, or the third switch responsive to a transition of the control unit between the master state and the slave state.
2. The system of
4. The system of
wherein the system is further configured so that a control unit in the master state energizes the control line, and
wherein each subsystem of the plurality of subsystems further comprises a switch control configured to actuate the third switch in response to the control line being energized.
5. The system of
6. The system of
7. The system of
8. The system of
the safety device further comprises a second input electrically coupled to the second power line, and the safety device is further configured to actuate the safety apparatus in response to the second input being at the de-energized state for the first time interval, and
each subsystem of the plurality of subsystems further comprises:
a second power source capable of energizing the second power line, the second power source configured to be controlled by the control unit;
a fourth switch electrically coupled to the second power source and to the second power line, the fourth switch configured to be closed while the control unit is in the master state;
a fifth switch electrically coupled to the second power source, the fifth switch configured to be closed while the control unit is in the slave state; and
a sixth switch electrically coupled to the fifth switch and to the second power line, the sixth switch configured to be open only while the control unit of any subsystem of the plurality of subsystems is in the master state, the system further configured to, within the first time interval, open or close the fourth switch, the fifth switch, or the sixth switch responsive to a transition of a control unit to or from the master state.
9. The system of
10. The system of
12. The system of
14. The system of
wherein the system is further configured so that a control unit of either the first or second subsystem in the master state energizes the control line, and
wherein the first and second subsystems each further comprise a switch control configured to actuate the third switch in response to the control line being energized.
16. The system of
17. The system of
18. The system of
the safety device further comprises a second input electrically coupled to the second power line, and the safety device is further configured to actuate the safety apparatus in response to the second input being at the de-energized state for the first time interval, and
the first and second subsystems each further comprise:
a second power source capable of energizing the second power line, the second power source configured to be controlled by the control unit;
a fourth switch electrically coupled to the second power source and to the second power line, the fourth switch configured to be closed while the control unit is in the master state;
a fifth switch electrically coupled to the second power source, the fifth switch configured to be closed while the control unit is in the slave state; and
a sixth switch electrically coupled to the fifth switch and to the second power line, the sixth switch configured to be open only while the control unit of either the first or second subsystem is in the master state, the system further configured to, within the first time interval, open or close the fourth switch, the fifth switch, or the sixth switch responsive to a transition of a control unit of either the first or second subsystem between the master state and the slave state.
19. The system of
20. The system of
|
To provide safety in the event of system failures, safety devices often are designed to actuate when an input that is energized during normal system operation becomes de-energized for a period of time. Some systems with such safety devices also include redundant controllers, each capable of operating in an active/master state for system control or in a passive/slave state, available to take control in the event that an active/master controller is no longer required for, or capable of, system control.
Switching control from a first controller to a second, redundant controller becomes problematic when the switchover takes longer than the safety device de-energization period, in which case the safety device unnecessarily actuates when not actually needed. In some systems, such as train control systems, a safety device may be an emergency braking system, and unneeded actuation of an emergency brake could slow the train unnecessarily and increase risk to passengers and crew as the emergency brake is applied.
While delays could be added to a safety device to allow controlled switchover before safety apparatus actuation, such delays introduce additional risks that would need to be accommodated, potentially increasing system complexity, reducing train headway, and increasing cost.
One or more embodiments are illustrated by way of example, and not by limitation, in the figures of the accompanying drawings, wherein elements having the same reference numeral designations represent like elements throughout and wherein:
It will be readily seen by one of ordinary skill in the art that the disclosed embodiments fulfill one or more of the advantages set forth above. After reading the foregoing specification, one of ordinary skill will be able to affect various changes, substitutions of equivalents and various other embodiments as broadly disclosed herein. It is therefore intended that the protection granted hereon be limited only by the definition contained in the appended claims and equivalents thereof.
The present description concerns a system and uses thereof. Although subject to other uses, the system is suitable to a vital or safety critical control system in which each of multiple redundant control units is able to switch between master and slave states without triggering actuation of a safety apparatus. Because safety apparatus actuation occurs after an input is de-energized for a time interval, seamless switchover is achieved by de-energizing and re-energizing the input before the time interval has elapsed. The system achieves seamless switchover of system control without relying on software timing or affecting the time required to actuate the safety apparatus.
Referring to
System 100 includes at least two subsystems 180. In some embodiments, system 100 includes more than two subsystems 180. In some embodiments, subsystems 180 are identical. In some embodiments, subsystems 180 vary with respect to composition but are uniform with respect to the features described below. In some embodiments, each of subsystems 180 is a safety subsystem.
Control unit 185 is a computing device comprising one or more processing units. In some embodiments, control unit 185 is a safety computing device. In some embodiments, control unit 185 has a checked redundant configuration having a first computing device and a second computing device. In some embodiments, control unit 185 is a vital on-board controller (VOBC) of a train. In some embodiments, a VOBC is implemented by running a background process on every vital machine having safety integrity level 4 (SIL 4) in system 100 which listens to communication traffic and collects key data as identified by a configuration profile of the VOBC. SIL 4 is based on International Electrotechnical Commission's (IEC) standard IEC 61508 and corresponds to a probability of hazards per hour ranging from 10−8 to 10−9. In some embodiments, control unit 185 is controller 600 described below with respect to
Control unit 185 is configured to be switchable between a master state and a slave state. In operation, control unit 185 operating in the master state is capable of controlling system 100. In operation, control unit 185 operating in the slave state is capable of controlling only a portion of system 100. System 100 is configured so that only one control unit 185 is capable of being in the master state at any given time.
First power line 110 and, if present, second power line 120, are an electrical conductor or plurality of conductors capable of delivering electrical energy between devices over a distance. In some embodiments, first power line 110 and, if present, second power line 120, are emergency brake trainlines of a train. In some embodiments, first power line 110 and, if present, second power line 120, are emergency brake trainlines of a train that span more than one train car.
Safety device 130 comprises first input 140, a safety apparatus 160 and/or relay 170. In some embodiments, safety device 130 comprises second input 150. Safety device 130 is an assembly configured to actuate safety apparatus 160 after a time interval has elapsed. In some embodiments, safety device 130 is an emergency braking control system and safety apparatus 160 is an emergency brake. In some embodiments, safety device 130 is an emergency braking control system of a train and safety apparatus 160 is an emergency brake of the train.
Safety device 130 is configured to actuate safety apparatus 160 based on first input 140 being in a de-energized state for a predetermined time interval. A de-energized state is a condition in which a potential energy, or voltage, level of a component of system 100 is at or near a ground or reference voltage level. In some embodiments, a potential energy, or voltage, level at or near the ground or reference voltage level is defined as a potential energy, or voltage, level having a magnitude below a first predetermined level.
An energized state is a condition in which the potential energy, or voltage, level of the component of system 100 has a magnitude above a second predetermined level. In various embodiments, the energized state corresponds to a potential energy, or voltage, of either polarity. In some embodiments, the first predetermined level is different from the second predetermined level. In some embodiments, the first predetermined level is the same as the second predetermined level.
In some embodiments, first input 140 is an input to relay 170. In some embodiments, relay 170 is configured so that, in operation, the de-energized state for the predetermined time interval at first input 140 causes relay 170 to open, thereby actuating safety apparatus 160.
In some embodiments, safety device 130 is configured to actuate safety apparatus 160 based on either first input 140 or second input 150 being in the de-energized state for the predetermined time interval. In some embodiments, first input 140 and second input 150 are inputs to relay 170. In some embodiments, relay 170 is configured so that, in operation, the de-energized state for the predetermined time interval at either of first input 140 or second input 150 causes relay 170 to open, thereby actuating safety apparatus 160.
In some embodiments, the predetermined time interval ranges from 100 milliseconds (msec) to 400 msec. In some embodiments, the predetermined time interval ranges from 200 msec to 300 msec.
First input 140 is electrically coupled to first power line 110. Each subsystem 180 is electrically coupled to first power line 110 and is capable of energizing and de-energizing first power line 110. In some embodiments, second input 150 is electrically coupled to second power line 120. In some embodiments, each subsystem 180 is electrically coupled to second power line 120 and is capable of energizing and de-energizing second power line 120. In some embodiments, each subsystem 180 is electrically coupled to first power line 110 and second power line 120 and is capable of energizing and de-energizing first power line 110 at a first polarity and energizing and de-energizing second power line 120 at a second polarity.
In some embodiments, each subsystem 180 is electrically connected to active control line 190. Active control line 190 is an electrical conductor or plurality of conductors capable of delivering electrical energy between devices over a distance. In some embodiments, active control line 190 is an active control line of a train. In some embodiments, active control line 190 is an active control line of a train that spans more than one train car.
In some embodiments, control unit 185 is configured to output one or more signals indicative of operating in either the master state or the slave state or of being in a failed state or otherwise shut down. In some embodiments, control unit 185 is configured to indicate master state operation by energizing active control line 190.
Each subsystem 180 is configured so that its control unit 185 is capable of causing subsystem 180 to energize first power line 110 and, if present, second power line 120, while its control unit 185 is in either the master state or the slave state.
System 100 is configured so that if a control unit 185 of a given subsystem 180 is in the master state, each control unit 185 of each other subsystem 180 is prevented from energizing first power line 110 and, if present, second power line 120.
In operation, prior to a given control unit 185 of a subsystem 180 switching from the slave state to the master state, two possible scenarios exist. In the first scenario, the given control unit 185 is taking over for a second control unit 185 that was previously in the master state. In the second scenario, the given control unit 185 is asserting control when all control units 185 of system 100 were previously in slave states.
In the first scenario, in operation, subsystem 180 of the second control unit 185 energizes first power line 110 and, if present, second power line 120 prior to the given control unit 185 switching to the master state. In the second scenario, in operation, every subsystem 180 of system 100 energizes first power line 110 and, if present, second power line 120 prior to the given control unit 185 switching to the master state.
In the second scenario, in operation, the given control unit 185 of a first subsystem 180 switching from the slave state to the master state causes first subsystem 180 to continue energizing first power line 110 and, if present, second power line 120.
In both scenarios, in operation, the given control unit 185 of the first subsystem 180 switching from the slave state to the master state also causes any second subsystem 180 to stop energizing first power line 110 and, if present, second power line 120. In some embodiments, in operation, the given control unit 185 switching from the slave state to the master state causes any second subsystem 180 to stop energizing first power line 110 and, if present, second power line 120, by energizing active control line 190, as discussed below.
System 100 is configured so that, in both scenarios, in operation, first subsystem 180 starts energizing first power line 110 and, if present, second power line 120, before the predetermined time interval for actuating safety apparatus 160 elapses after the second subsystem stops energizing first power line 110 and, if present, second power line 120.
In operation, because first power line 110 and, if present, second power line 120, is/are not de-energized for longer than the predetermined time interval, safety apparatus 160 is not actuated. By avoiding actuation of safety apparatus 160, system 100 is configured to provide seamless switchover of control to a control unit 185 switching from slave state to master state. An example embodiment of a subsystem 180 configured to provide seamless switchover for system 100 is discussed below with respect to
Referring to
Subsystem 180 is a first subsystem of a plurality of subsystems 180 in system 100. Each of first subsystem 180, a second subsystem 180, and, if present, one or more additional subsystems 180, is configured to include the features described with respect to
In the discussion below, components of subsystem 180 are first described, followed by an explanation of how the various components are configured so as to interact to enable seamless switchover. Control unit 185 is configured to control first power source 220 and, if present, second power source 230. In operation, control unit 185 operating in the master state or in the slave state is capable of controlling first power source 220 and, if present, second power source 230. First switch 241 is electrically coupled to first power source 220 and to first power line 110. Second switch 242 is electrically coupled to first power source 220 and to third switch 243. Third switch 243 is electrically coupled to second switch 242 and to first power line 110.
In some embodiments, switch control 247 is electrically coupled to active control line 190, switch 243, and, if present, switch 246.
By the configuration of subsystem 180, in operation, if first switch 241 is open, first power source 220 cannot energize first power line 110 through the path that includes first switch 241. In operation, if either second switch 242 or third switch 243 is open, first power source 220 cannot energize first power line 110 through the path that includes second switch 242 and third switch 243.
In operation, first power source 220 potentially energizes first power line 110 if either first switch 241 is closed or if both second switch 242 and third switch 243 are closed.
In some embodiments, fourth switch 244 is electrically coupled to second power source 230 and to second power line 120. In some embodiments, fifth switch 245 is electrically coupled to second power source 230 and to sixth switch 246. Sixth switch 246 is electrically coupled to fifth switch 245 and to second power line 120.
By the configuration of subsystem 180, in some embodiments, in operation, if fourth switch 244 is open, second power source 230 cannot energize second power line 120 through the path that includes fourth switch 244. In some embodiments, in operation, if either fifth switch 245 or sixth switch 246 is open, second power source 220 cannot energize second power line 120 through the path that includes fifth switch 245 and sixth switch 246.
In some embodiments, in operation, second power source 230 potentially energizes second power line 120 if either fourth switch 244 is closed or if both fifth switch 245 and sixth switch 246 are closed.
Each of switches 241-246 is configured to switch between open and closed states in a time period that is less than the predetermined time interval for actuation of safety apparatus 160. In some embodiments, in operation, each of switches 241-246 switches between open and closed states in a time period that ranges from 10 msec or less to 90 msec. In some embodiments, in operation, each of switches 241-246 switches between open and closed states in a time period that ranges from 20 msec to 60 msec. In some embodiments, in operation, each of switches 241-246 switches between open and closed states in a time period of about 40 msec.
Because each of switches 241-246 is configured to switch between open and closed states in a time period that is significantly less than the predetermined time interval for actuation of safety apparatus 160, the configurations of system 100 and each subsystem 180 enable seamless switchover of control to control unit 185 switching to the master state, as discussed below.
In some embodiments, with respect to
In some embodiments, system 100 is configured so that, in operation, at least one of second power source 230, second power line 120, second input 150, fourth switch 244, fifth switch 245, and sixth switch 246 functions as described below for first power source 220, first power line 110, first input 140, first switch 241, second switch 242, and third switch 243, respectively, and is controlled to operate in tandem with its respective counterpart.
In some embodiments, control unit 185 is configured to perform self-tests to detect failures, and, if detected, shut down from either the master state or the slave state into the failed state. In some embodiments, in operation, in the failed state, control unit 185 is not capable of controlling first power source 220, second power source 230, if present, or other elements of the general system that includes system 100. In operation, control unit 185 transitioning from, or ending, operation in the master state includes either switching to the slave state or to shutting down, including due to entering the failed state.
In some embodiments, control unit 185 comprises one or more inputs configured to allow verification of the energized or de-energized state of one or more of first power line 110 and, if present, second power line 120 and active control line 190. In some embodiments, third switch 243 and, if present, sixth switch 246 are contacts of a relay and control unit 185 comprises an input capable of sensing the status of one or more contacts of the relay.
First power source 220 is an assembly capable of energizing first power line 110 and of being controlled by control unit 185. In some embodiments, second power source 230 is an assembly capable of energizing second power line 120 and of being controlled by control unit 185. In some embodiments, first power source 220 has a first polarity and second power source has a second polarity opposite the first polarity. In some embodiments, first power source 220 and second power source 230 are configured to be controlled separately by control unit 185. In some embodiments, first power source 220 and second power source 230 are configured to be controlled in tandem by control unit 185 such that, in operation, first power source 220 and second power source 230 are powered on and off simultaneously.
In some embodiments, vital supervision card (VSC) 250 is configured to further control an energizing output of first power source 220 and an energizing output of second power source 230, if present. In some embodiments, VSC 250 is activated only when control unit 185 is healthy. In some embodiments, first switch 241 and second switch 242 are electrically coupled to first power source 220 through VSC 250. In some embodiments, fourth switch 244 and fifth switch 245 are electrically coupled to second power source 230 through VSC 250.
In some embodiments, VSC 250 is configured to monitor a dynamic output signal from control unit 185 and control delivery of power from first power source 220 to switches 241 and 242 based on detection of a valid output signal. In some embodiments, VSC 250 is configured to monitor a dynamic output signal from control unit 185 and control delivery of power from second power source 230 to switches 244 and 245 based on detection of a valid output signal.
In some embodiments, in operation, control unit 185 transitions out of the master or the slave state into the failed state as a result of a failure by VSC 250 to detect a valid output signal from control unit 185. In some embodiments, VSC 250 is configured for safety integrity level 4 (SIL 4) compliance.
First switch 241 is configured to be closed while control unit 185 is operating in the master state and open while control unit 185 is not operating in the master state, in which case switch 241 is open and control unit 185 is in the slave state or the failed state or otherwise shut down. Second switch 242 is configured to be open while control unit 185 is operating in the master state and closed while control unit 185 is not operating in the master state, in which case second switch 242 is closed and control unit 185 is in the slave state or the failed state or otherwise shut down.
In some embodiments, first switch 241 and second switch 242 are contacts of a relay configured with an “exclusive-or” logic so that, in operation, one contact is always closed while the other contact is open. In some embodiments, first switch 241 and second switch 242 are contacts of a safety relay such as a force-activated relay (FAR).
In some embodiments, first switch 241 and second switch 242 are configured to respond to one or more signals indicative of control unit 185 operating in the master state or the slave state or of being in the failed state or otherwise shut down. In some embodiments, first switch 241 and second switch 242 are contacts of a relay configured to respond to one or more signals indicative of control unit 185 operating in either the master state or the slave state or of being in the failed state or otherwise shut down.
In operation, while control unit 185 is in the master state, first switch 241 is closed, and control unit 185 controls first power source 220 to energize and/or de-energize first power line 110 through first switch 241, thereby energizing and/or de-energizing first input 140 of safety device 130 to control safety apparatus 160.
In operation, while control unit 185 is in the slave state or in the failed state or otherwise shut down, first switch 241 is open and control unit 185 is not capable of energizing first power line 110 through first switch 241 so as to prevent actuation of safety apparatus 160 due first input 140 being de-energized for the time interval.
Third switch 243 is configured to be open while control unit 185 of first subsystem 180 of
In some embodiments, third switch 243 is configured to respond to one or more signals indicative of a control unit 185 of any one of subsystem 180 in system 100 operating in the master state or the slave state or of being in the failed state or otherwise shut down. In some embodiments, third switch 243 is configured to open in response to actuation of switch control 247.
In some embodiments, switch control 247 is configured to actuate third switch 243 in response to active control line 190 being energized. In some embodiments, switch control 247 is a FAR relay and third switch 243 is a contact of the FAR relay configured to be open when switch control 247 is actuated in response to active control line 190 being energized by any control unit 185 of any subsystem 180.
In some embodiments, switch control 247 is an assembly configured to, in response to a signal indicative of any control unit 185 of any one of subsystem 180 in system 100 operating in the master state, cause third switch 243 to switch from a closed state to an open state in a time period that is less than the predetermined time interval for actuation of safety apparatus 160.
Referring to
In operation, control unit 185 (not shown) of first subsystem 181 of
In operation, control unit 185 (not shown) of second subsystem 182 of
In operation, both control unit 185 of first subsystem 181 and control unit 185 of second subsystem 182 of
In the switch configuration illustrated in
Referring again to
In operation, whether control unit 185 transitions to the slave state or shuts down, until control unit 185 of another subsystem 180 of system 100 transitions from the slave state to the master state, control unit 185 of at least one other subsystem 180 of system 100 is capable of controlling an associated first power source 220 to energize first power line 110 through associated second switch 242 and third switch 243.
By the configuration of subsystem 180, in operation, if control unit 185 transitions from the slave state to the master state, first switch 241 closes and second switch 242 opens. Also, in some embodiments, because system 100 is configured so that only one control unit 185 can be in the master state at any given time and no control unit of another subsystem 180 can be in the master state, in operation, third switch 243 opens from a previously closed condition. In some embodiments, in operation, third switch 243 opens from a previously closed condition because active control line 190 becomes energized by control unit 185 of subsystem 180 transitioning to the master state.
In operation, the situation in which control unit 185 transitions from the slave state to the master state applies if control unit 185 is taking control from an initialized state in which control unit 185 of each subsystem 180 of system 100 is in the slave state. This situation also applies if control unit 185 takes control following failure of control unit 185 of another subsystem 180 of system 100, which initially results in a similar state in which control unit 185 of each subsystem 180 of system 100 is in the slave state.
The operational timing illustrated in
As discussed below, while
S1E represents a subsystem state in which first power line 110 is energized by the first power source 220 of a first subsystem 180, through closure of either first switch 241 or second switch 242 and third switch 243. S1N represents a state in which first power line 110 is not energized by first power source 220 of first subsystem 180, based on first switch 241 being open and at least one of second switch 242 and third switch 243 being open.
S2E represents a subsystem state in which first power line 110 is energized by the first power source 220 of a second subsystem 180, through closure of either first switch 241 or second switch 242 and third switch 243. S2N represents a state in which first power line 110 is not energized by first power source 220 of second subsystem 180, based on first switch 241 being open and at least one of second switch 242 and third switch 243 being open.
Because first power line 110 can be energized by first power source 220 of either first or second subsystem 180, either or both of states S1E and S2E creates energized state E1, while a combination of both states S1N and S2N is required for de-energized state E0.
A first operational sequence, illustrated in
A second operational sequence, illustrated in
In some embodiments,
At time T0 in the first operational sequence, first subsystem 180 therefore changes from state S1E to state S1N while second subsystem 180 remains at state S2N until the associated switches have changed states. With first subsystem 180 in state S1N and second subsystem 180 in state S2N, first power line 110 therefore transitions to de-energized state E0 at time T0, as illustrated in
At time T1 in the first operational sequence, in some embodiments, third switch 243 of second subsystem 180 closes in response to the transition of control unit 185 of first subsystem 180 out of the master state. Because control unit 185 of second subsystem 180 is in the slave state, second switch 242 is already closed, and closing of third switch 243 allows first power source 220 of second subsystem 180 to energize first power line 110, thereby changing second subsystem 180 from state S2N to S2E. In some embodiments, switch 243 closes in response to active control line 190 becoming de-energized by control unit 185 of first subsystem 180 transitioning out of the master state.
With first subsystem 180 in state S1N and second subsystem 180 in state S2E, first power line transitions from de-energized state E0 to energized state E1 at time T1, as illustrated by the solid lines in
At time T1 in the first operational sequence, in some embodiments, control unit 185 of second subsystem 180 transitions from the slave state to the master state in response to control unit 185 of first subsystem 180 transitioning out of the master state. In this case, first switch 241 of second subsystem 180 closes in response to the transition of control unit 185 of second subsystem 180 into the master state, so first power source 220 of second subsystem 180 energizes first power line 110 and second subsystem 180 transitions from state S2N to S2E. With first subsystem 180 in state S1N and second subsystem 180 in state S2E, first power line transitions from de-energized state E0 to energized state E1 at time T1, as illustrated by the solid lines in
At time T1 in the first operational sequence, in some embodiments, third switch 243 of first subsystem 180 closes in response to transition of control unit 185 of first subsystem 180 out of the master state to the slave state. Because control unit 185 of first subsystem 180 has transitioned to the slave state, second switch 242 closes, and closing of third switch 243 allows first power source 220 of first subsystem 180 to energize first power line 110, thereby changing first subsystem 180 from state S1N to S1E. With first subsystem 180 in state S1E and second subsystem 180 in state S2N, illustrated by the dashed lines in
At time T1 in the first operational sequence, in some embodiments, third switch 243 of both first subsystem 180 and second subsystem 180 close at time T1. In this case, first subsystem 180 transitions from S1N to S1E, as illustrated by the dashed line, and second subsystem 180 transitions from S2N to S2E, as illustrated by the solid line. With first subsystem 180 in state S1E and second subsystem 180 in state S2E, first power line transitions from de-energized state E0 to energized state E1 at time T1.
As illustrated in
In some embodiments,
At time T0 in the second operational sequence, control unit 185 of first subsystem 180 transitions from the slave state to the master state, and switch 243 of both first subsystem 180 and second subsystem 180 opens. Therefore, first subsystem 180 transitions from state S1E to state S1N and second subsystem 180 transitions from state S2E to state S2N. With first subsystem 180 in state S1N and second subsystem 180 in state S2N, first power line 110 therefore transitions to de-energized state E0 at time T0, as illustrated in
At time T1 in the second operational sequence, in some embodiments, in response to control unit 185 of first subsystem 180 transitioning from the slave state to the master state, first switch 241 of first subsystem 180 closes and first power source 220 of first subsystem 180 energizes first power line 110, first subsystem 180 thereby transitioning from state S1N to S1E while second subsystem 180 remains in state S2N. With first subsystem 180 in state S1E and second subsystem 180 in state S2N, first power line 110 transitions from de-energized state E0 to energized state E1 at time T1, as illustrated in
As illustrated in
While subsystem 1 is in master state M, switch 241 of subsystem 1 is closed while switches 242 and 243 are open. When subsystem 1 switches to slave state S, switch 241 opens while switches 242 and 243 close. Switch 243 remains closed until subsystem 2 switches from slave state S to master state M, at which time switch 243 opens.
While subsystem 2 in slave state S, switch 241 of subsystem 2 is open. When subsystem 2 switches from slave state S to master state M, switch 241 closes while switches 242 and 243 open.
First power line 110 remains energized throughout the third operational sequence. While subsystem 1 is in master state M and subsystem 2 is in slave state S, first power line 110 is energized at 241-1 by switch 241 of subsystem 1. While subsystem 1 and subsystem 2 are both in slave state S, first power line 110 is energized at 242/243—Multiple by switches 242 and 243 in both subsystem 1 and subsystem 2. While subsystem 1 is in slave state S and subsystem 2 is in master state M, first power line 110 is energized at 241-2 by switch 241 of subsystem 2.
The present description also concerns methods of seamlessly switching control. An example embodiment of a method 400 of seamlessly switching control is depicted in
In operation 410, a first input to a safety device is energized through a first power line, the safety device configured to actuate a safety apparatus in response to the first input being at a de-energized state for a first time interval.
In operation 420, the first power line is energized by a first power source through a first switch, the first power source being controlled by a first control unit operating in a master state.
In operation 430, master state operation of the first control unit is ended. In some embodiments, ending master state operation comprises transitioning to a slave state. In some embodiments, ending master state operation comprises transitioning to a failed state or otherwise being shut down.
In operation 440, In response to ending master state operation of the first control unit, the first switch is opened, a second switch electrically coupled to the first power source is closed, and the first power line is energized by closing a third switch electrically coupled to the first power line. Opening the first switch and closing the second switch and the third switch are completed within the first time interval.
In operation 450, in some embodiments, a second input to the safety device is energized through a second power line, the second power line is energized by a second power source through a fourth switch, the second power source being controlled by the first control unit operating in master state. In response to ending master state operation of the first control unit, the fourth switch is opened, a fifth switch electrically coupled to the second power source is closed, and the second power line is energized by closing a sixth switch electrically coupled to the second power line. Opening the fourth switch and closing the fifth switch and the sixth switch are completed within the first time interval.
In operation 460, in some embodiments, a second control unit is switched from slave state operation to master state operation, and, in response, the third switch and the sixth switch are opened. The second control unit controls a third power source and the first power line is energized by closing a seventh switch electrically coupled to the third power source and to the first power line. Opening the third switch and the sixth switch and closing the seventh switch are completed within the first time interval.
In operation 470, in some embodiments, prior to ending master state operation of the first control unit, a verification sequence is executed in which the first power source is controlled by the first control unit to de-energize the first power line, and the first control unit verifies the de-energized state of the first power line. In some embodiments, the first control unit verifies the de-energized state of the first power line through an input of the first control unit.
In some embodiments, the verification sequence includes additional operations. In some embodiments, the verification sequence is a method of verifying operation of a system for seamless switchover of safety control such as method 700 described below with respect to
Another example embodiment of seamlessly switching control is method 500 depicted in
In operation 510, a first input to a safety device is energized through a first power line, the safety device configured to actuate a safety apparatus in response to the first input being at a de-energized state for a first time interval.
In operation 520, the first power line is energized by a first power source through a second switch and a third switch, the first power source being controlled by a first control unit operating in a slave state.
In operation 530, operation of the first control unit is switched from slave state to a master state.
In operation 540, in response to beginning master state operation of the first control unit, the third switch and the second switch are opened, and the first power line is energized by closing a first switch electrically coupled to the first power source and to the first power line. Opening the third switch and the second switch, and closing the first switch are completed within the first time interval.
In operation 550, in some embodiments, a second power source is being controlled by a second control unit operating in slave state, and a fourth switch between the second power source and the first power line is opened in response to beginning master state operation of the first control unit.
The present description also concerns methods of verifying operation of a system for seamless switchover of safety control. An example embodiment of a method 700 of verifying operation of a system for seamless switchover of safety control is depicted in
In operation 710, a first power source is controlled by a first control unit in master state to de-energize a first power line. In some embodiments, a second power source is also controlled by the first control unit to de-energize a second power line. In some embodiments, an active control line remains energized while the first and, if present, second power lines are de-energized.
In operation 720, the first control unit verifies the de-energized state of the first power line. In some embodiments, the first control unit verifies the de-energized state of the first power line through an input of the first control unit. In some embodiments, the first control unit also verifies the de-energized state of the second power line through the same or another input of the first control unit. In some embodiments, the first control unit verifies the de-energized state of the first power line by verifying that a voltage level of the first power line is below a predetermined voltage level.
In operation 730, in some embodiments, a second control unit verifies the de-energized state of the first power line. In some embodiments, the second control unit verifies the de-energized state of the first power line through an input of the second control unit. In some embodiments, the second control unit verifies the de-energized state of the first power line by verifying that a voltage level of the first power line is below a predetermined voltage level.
In some embodiments, the second control unit also verifies the de-energized state of the second power line through the same or another input of the second control unit. In some embodiments, the second control unit verifies the de-energized state of the second power line by verifying that a voltage level of the second power line is below a predetermined voltage level.
In some embodiments, the second control unit verifies the energized state of the active control line. In some embodiments, the second control unit verifies the energized state of the active control line by verifying that a voltage level of the active control line is above a predetermined voltage level.
In some embodiments, verification of the various energized and de-energized states by the second control unit is initiated by the first control unit.
In operation 740, in some embodiments, an active control line is de-energized by the first control unit.
In operation 750, in some embodiments, the first control unit verifies the de-energized state of the active control line. In some embodiments, the first control unit verifies the de-energized state of the active control line through an input of the first control unit.
In operation 760, in some embodiments, after the de-energizing of the active control line, the second control unit verifies active control line operation. In some embodiments, the second control unit verifies active control line operation by verifying energized and/or de-energized states of the active control line through an input of the second control unit. In some embodiments, the second control unit verifying active control line operation includes de-energizing and energizing a second power source controlled by the second control unit.
In operation 770, in some embodiments, the active control line is energized by the first control unit. In some embodiments, the active control line is energized by the first control unit while the second control unit is verifying active control line operation as described with respect to operation 760. In some embodiments, the first control unit verifies the energized state of the active control line. In some embodiments, the first control unit verifies the energized state of the active control line by verifying that a voltage level of the active control line is above a predetermined voltage level.
In operation 780, in some embodiments, the first power source is controlled by the first control unit (in master state) to energize the first power line. In some embodiments, the second power source is also controlled by the first control unit to energize the second power line. In some embodiments, the first control unit verifies the energized state of the first power line. In some embodiments, the first control unit verifies the energized state of the first power line by verifying that a voltage level of the first power line is above a predetermined voltage level.
In some embodiments, the first control unit also verifies the energized state of the second power line. In some embodiments, the first control unit verifies the energized state of the second power line by verifying that a voltage level of the second power line is above a predetermined voltage level.
In some embodiments, the processor 602 is a central processing unit (CPU), a multi-processor, a distributed processing system, an application specific integrated circuit (ASIC), and/or a suitable processing unit. In some embodiments, processor 602 is configured to receive master/slave information signals via network interface 612. In some embodiments, processor 602 is configured to generate master/slave control information signals for transmitting to external circuitry via network interface 612.
In some embodiments, the computer readable storage medium 604 is an electronic, magnetic, optical, electromagnetic, infrared, and/or a semiconductor system (or apparatus or device). For example, the computer readable storage medium 604 includes a semiconductor or solid-state memory, a magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and/or an optical disk. In some embodiments using optical disks, the computer readable storage medium 604 includes a compact disk-read only memory (CD-ROM), a compact disk-read/write (CD-R/W), and/or a digital video disc (DVD). In some embodiments, the computer readable storage medium 604 is part of an embedded microcontroller or a system on chip (SoC).
In some embodiments, the storage medium 604 stores the computer program code 606 configured to cause controller 600 to perform some or all of the operations as described with respect to seamless switchover system 100 (
Controller 600 includes I/O interface 610. I/O interface 610 is coupled to external circuitry. In some embodiments, I/O interface 610 is configured to receive instructions from a port in an embedded controller. In some embodiments, I/O interface 610 includes one or more inputs configured to allow verification of the status of one or more system elements as described with respect to seamless switchover system 100.
Controller 600 also includes network interface 612 coupled to the processor 602. Network interface 612 allows Controller 600 to communicate with network 614, to which one or more other computer systems are connected. Network interface 612 includes wireless network interfaces such as BLUETOOTH, WIFI, WIMAX, GPRS, or WCDMA; or wired network interface such as ETHERNET, USB, IEEE-1394, or asynchronous or synchronous communications links, such as RS485, CAN or HDLC. In some embodiments, the operations as described with respect to Controller 600 are implemented in two or more seamless switchover systems, and information such as master/slave information is exchanged between different Controller 600 via network 614.
Controller 600 is configured to receive information related to test algorithms from a user or an external circuit. The information is transferred to processor 602 via bus 608 and stored in computer readable medium 604 as test algorithm parameter 618.
During operation, processor 602 executes a set of instructions to seamlessly switch safety control as described with respect to seamless switchover system 100 (
Although the embodiments and its advantages have been described in detail, it should be understood that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of the invention as defined by the appended claims. Moreover, the scope of the present application is not intended to be limited to the particular embodiments of the process, machine, manufacture, and composition of matter, means, methods and operations described in the specification. As one of ordinary skill in the art will readily appreciate from the disclosure of the present invention, processes, machines, manufacture, compositions of matter, means, methods, or operations, presently existing or later to be developed, that perform substantially the same function or achieve substantially the same result as the corresponding embodiments described herein may be utilized according to the present invention. Accordingly, the appended claims are intended to include within their scope such processes, machines, manufacture, compositions of matter, means, methods, or operations.
Kanner, Abe, Lungu, Mihai, Zhao, Janice
Patent | Priority | Assignee | Title |
11718331, | Nov 27 2017 | CASCO SIGNAL CO , LTD | Non-national standard turnout drive system based on double 2-vote-2 architecture |
Patent | Priority | Assignee | Title |
5487149, | Dec 29 1993 | Hyundai Electronics Industries Co., Inc. | Common control redundancy switch method for switching a faulty active common control unit with an inactive spare common control unit |
5689398, | Jan 03 1996 | Allen-Bradley Company, Inc. | Redundant control relay circuits |
5786996, | Jun 28 1996 | Ranco Incorporated of Delaware | Appliance control circuit comprising dual microprocessors for enhanced control operation and agency safety redundancy and software application method thereof |
6591150, | Sep 03 1999 | Fujitsu Limited | Redundant monitoring control system, monitoring control apparatus therefor and monitored control apparatus |
6820946, | May 14 1999 | Hydro-Aire, Inc. | Dual redundant active/active brake-by-wire architecture |
7140577, | Apr 08 2004 | General Electric Company | Remote system for monitoring and controlling railroad wayside equipment |
7290170, | Apr 07 2004 | International Business Machines Corporation | Arbitration method and system for redundant controllers, with output interlock and automatic switching capabilities |
7505820, | Mar 30 2006 | Honeywell International Inc. | Backup control for solid state power controller (SSPC) |
8270422, | Jun 30 2008 | Huawei Technologies Co., Ltd. | Active/standby switchover method and device of asynchronous backplane in transport network |
8620559, | Aug 25 2008 | Continental Automotive GmbH | Method for executing tasks and system comprising a first and a second control device |
8668170, | Jun 27 2011 | GROUND TRANSPORTATION SYSTEMS CANADA INC | Railway signaling system with redundant controllers |
8793405, | Sep 29 2009 | LENOVO BEIJING CO , LTD ; Beijing Lenovo Software Ltd | Portable terminal and control method thereof, portable device and control method thereof |
8856413, | Jul 27 2009 | Ziehl-Abegg AG | Device and method for addressing a slave unit |
20050043859, | |||
20060174051, | |||
20070228223, | |||
20090319056, | |||
20130079902, | |||
20130158844, | |||
20130294227, | |||
20140351432, | |||
20150032302, | |||
20150053514, | |||
WO2014117940, | |||
WO2014161909, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Nov 18 2016 | Thales Canada Inc | (assignment on the face of the patent) | / | |||
Nov 22 2016 | LUNGU, MIHAI | Thales Canada Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 041099 | /0671 | |
Nov 22 2016 | ZHAO, JANICE | Thales Canada Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 041099 | /0671 | |
Dec 16 2016 | KANNER, ABE | Thales Canada Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 041099 | /0671 | |
Sep 19 2023 | Thales Canada Inc | GROUND TRANSPORTATION SYSTEMS CANADA INC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 065566 | /0509 |
Date | Maintenance Fee Events |
Nov 15 2022 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
Date | Maintenance Schedule |
Jun 25 2022 | 4 years fee payment window open |
Dec 25 2022 | 6 months grace period start (w surcharge) |
Jun 25 2023 | patent expiry (for year 4) |
Jun 25 2025 | 2 years to revive unintentionally abandoned end. (for year 4) |
Jun 25 2026 | 8 years fee payment window open |
Dec 25 2026 | 6 months grace period start (w surcharge) |
Jun 25 2027 | patent expiry (for year 8) |
Jun 25 2029 | 2 years to revive unintentionally abandoned end. (for year 8) |
Jun 25 2030 | 12 years fee payment window open |
Dec 25 2030 | 6 months grace period start (w surcharge) |
Jun 25 2031 | patent expiry (for year 12) |
Jun 25 2033 | 2 years to revive unintentionally abandoned end. (for year 12) |